Newbie to splunk, but I want to aggregate the log entries below based upon if it's the same ip address and request url.
192.168.8.5 [10/Nov/2011:11:11:23] "GET /hello/world HTTP/1.1" 200 1234
192.168.8.7 [10/Nov/2011:15:46:23] "GET /foo/bar HTTP/1.1" 200 124
192.168.8.5 [10/Nov/2011:18:00:25] "GET /foo/bar HTTP/1.1" 200 124
192.168.8.10 [10/Nov/2011:23:11:23] "GET /hello/world HTTP/1.1" 200 1234
192.168.8.5 [10/Nov/2011:23:59:00] "GET /hello/world HTTP/1.1" 200 1234
So the outcome I would like is as follows:
ip address request url count
192.168.8.5 "GET /hello/world HTTP/1.1" 2
192.168.8.7 "GET /foo/bar HTTP/1.1" 1
192.168.8.5 "GET /foo/bar HTTP/1.1" 1
192.168.8.10 "GET /hello/world HTTP/1.1" 1
Can someone provide some insight? I've played around with dedup and distinct_count but can't seem to get it right to get the aggregated information from splunk.
Thanks in advance.
... View more